From 9ac2c791064a58602368e8a2819ad7f916f52379 Mon Sep 17 00:00:00 2001 From: "Md. Anisur Rahman" <54911684+anisurrahman75@users.noreply.github.com> Date: Mon, 30 Sep 2024 15:47:07 +0600 Subject: [PATCH] wip Signed-off-by: sayedppqq --- docs/guides/ferretdb/autoscaler/_index.md | 10 + docs/guides/ferretdb/concepts/_index.md | 10 + docs/guides/ferretdb/concepts/appbinding.md | 147 ++++++++++ docs/guides/ferretdb/concepts/autoscaler.md | 73 +++++ docs/guides/ferretdb/concepts/catalog.md | 74 +++++ docs/guides/ferretdb/concepts/ferretdb.md | 298 ++++++++++++++++++++ docs/guides/ferretdb/concepts/opsrequest.md | 258 +++++++++++++++++ docs/guides/mongodb/concepts/mongodb.md | 2 +- docs/guides/pgpool/concepts/pgpool.md | 2 +- 9 files changed, 872 insertions(+), 2 deletions(-) create mode 100644 docs/guides/ferretdb/autoscaler/_index.md create mode 100644 docs/guides/ferretdb/concepts/_index.md create mode 100644 docs/guides/ferretdb/concepts/appbinding.md create mode 100644 docs/guides/ferretdb/concepts/autoscaler.md create mode 100644 docs/guides/ferretdb/concepts/catalog.md create mode 100644 docs/guides/ferretdb/concepts/ferretdb.md create mode 100644 docs/guides/ferretdb/concepts/opsrequest.md diff --git a/docs/guides/ferretdb/autoscaler/_index.md b/docs/guides/ferretdb/autoscaler/_index.md new file mode 100644 index 0000000000..9c3849b4cc --- /dev/null +++ b/docs/guides/ferretdb/autoscaler/_index.md @@ -0,0 +1,10 @@ +--- +title: Autoscaling +menu: + docs_{{ .version }}: + identifier: fr-auto-scaling + name: Autoscaling + parent: fr-ferretdb-guides + weight: 46 +menu_name: docs_{{ .version }} +--- \ No newline at end of file diff --git a/docs/guides/ferretdb/concepts/_index.md b/docs/guides/ferretdb/concepts/_index.md new file mode 100644 index 0000000000..7dd4a47c33 --- /dev/null +++ b/docs/guides/ferretdb/concepts/_index.md @@ -0,0 +1,10 @@ +--- +title: FerretDB Concepts +menu: + docs_{{ .version }}: + identifier: fr-concepts-ferretdb + name: Concepts + parent: fr-quickstart-ferretdb + weight: 15 +menu_name: docs_{{ .version }} +--- \ No newline at end of file diff --git a/docs/guides/ferretdb/concepts/appbinding.md b/docs/guides/ferretdb/concepts/appbinding.md new file mode 100644 index 0000000000..77c6731c5a --- /dev/null +++ b/docs/guides/ferretdb/concepts/appbinding.md @@ -0,0 +1,147 @@ +--- +title: AppBinding CRD +menu: + docs_{{ .version }}: + identifier: fr-appbinding-concepts + name: AppBinding + parent: fr-concepts-ferretdb + weight: 20 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# AppBinding + +## What is AppBinding + +An `AppBinding` is a Kubernetes `CustomResourceDefinition`(CRD) which points to an application using either its URL (usually for a non-Kubernetes resident service instance) or a Kubernetes service object (if self-hosted in a Kubernetes cluster), some optional parameters and a credential secret. To learn more about AppBinding and the problems it solves, please read this blog post: [The case for AppBinding](https://appscode.com/blog/post/the-case-for-appbinding). + +If you deploy a database using [KubeDB](https://kubedb.com/docs/0.11.0/concepts/), `AppBinding` object will be created automatically for it. Otherwise, you have to create an `AppBinding` object manually pointing to your desired database. + +KubeDB uses [Stash](https://appscode.com/products/stash/) to perform backup/recovery of databases. Stash needs to know how to connect with a target database and the credentials necessary to access it. This is done via an `AppBinding`. + +## AppBinding CRD Specification + +Like any official Kubernetes resource, an `AppBinding` has `TypeMeta`, `ObjectMeta` and `Spec` sections. However, unlike other Kubernetes resources, it does not have a `Status` section. + +An `AppBinding` object created by `KubeDB` for PostgreSQL database is shown below, + +```yaml +apiVersion: appcatalog.appscode.com/v1alpha1 +kind: AppBinding +metadata: + labels: + app.kubernetes.io/component: database + app.kubernetes.io/instance: quick-postgres + app.kubernetes.io/managed-by: kubedb.com + app.kubernetes.io/name: postgreses.kubedb.com + name: quick-postgres + namespace: demo +spec: + appRef: + apiGroup: kubedb.com + kind: Postgres + name: quick-postgres + namespace: demo + clientConfig: + service: + name: quick-postgres + path: / + port: 5432 + query: sslmode=disable + scheme: postgresql + secret: + name: quick-postgres-auth + type: kubedb.com/postgres + version: "13.13" +``` + +Here, we are going to describe the sections of an `AppBinding` crd. + +### AppBinding `Spec` + +An `AppBinding` object has the following fields in the `spec` section: + +#### spec.type + +`spec.type` is an optional field that indicates the type of the app that this `AppBinding` is pointing to. Stash uses this field to resolve the values of `TARGET_APP_TYPE`, `TARGET_APP_GROUP` and `TARGET_APP_RESOURCE` variables of [BackupBlueprint](https://appscode.com/products/stash/latest/concepts/crds/backupblueprint/) object. + +This field follows the following format: `/`. The above AppBinding is pointing to a `postgres` resource under `kubedb.com` group. + +Here, the variables are parsed as follows: + +| Variable | Usage | +| --------------------- | --------------------------------------------------------------------------------------------------------------------------------- | +| `TARGET_APP_GROUP` | Represents the application group where the respective app belongs (i.e: `kubedb.com`). | +| `TARGET_APP_RESOURCE` | Represents the resource under that application group that this appbinding represents (i.e: `postgres`). | +| `TARGET_APP_TYPE` | Represents the complete type of the application. It's simply `TARGET_APP_GROUP/TARGET_APP_RESOURCE` (i.e: `kubedb.com/postgres`). | + +#### spec.secret + +`spec.secret` specifies the name of the secret which contains the credentials that are required to access the database. This secret must be in the same namespace as the `AppBinding`. + +This secret must contain the following keys: + +PostgreSQL : + +| Key | Usage | +|------------|------------------------------------------------| +| `username` | Username of the target database. | +| `password` | Password for the user specified by `username`. | + +MySQL : + +| Key | Usage | +| ---------- | ---------------------------------------------- | +| `username` | Username of the target database. | +| `password` | Password for the user specified by `username`. | + +MongoDB : + +| Key | Usage | +| ---------- | ---------------------------------------------- | +| `username` | Username of the target database. | +| `password` | Password for the user specified by `username`. | + +Elasticsearch: + +| Key | Usage | +| ---------------- | ----------------------- | +| `ADMIN_USERNAME` | Admin username | +| `ADMIN_PASSWORD` | Password for admin user | + +#### spec.clientConfig + +`spec.clientConfig` defines how to communicate with the target database. You can use either a URL or a Kubernetes service to connect with the database. You don't have to specify both of them. + +You can configure following fields in `spec.clientConfig` section: + +- **spec.clientConfig.url** + + `spec.clientConfig.url` gives the location of the database, in standard URL form (i.e. `[scheme://]host:port/[path]`). This is particularly useful when the target database is running outside the Kubernetes cluster. If your database is running inside the cluster, use `spec.clientConfig.service` section instead. + + +> Note that, attempting to use a user or basic auth (e.g. `user:password@host:port`) is not allowed. Stash will insert them automatically from the respective secret. Fragments ("#...") and query parameters ("?...") are not allowed either. + +- **spec.clientConfig.service** + + If you are running the database inside the Kubernetes cluster, you can use Kubernetes service to connect with the database. You have to specify the following fields in `spec.clientConfig.service` section if you manually create an `AppBinding` object. + + - **name :** `name` indicates the name of the service that connects with the target database. + - **scheme :** `scheme` specifies the scheme (i.e. http, https) to use to connect with the database. + - **port :** `port` specifies the port where the target database is running. + +- **spec.clientConfig.insecureSkipTLSVerify** + + `spec.clientConfig.insecureSkipTLSVerify` is used to disable TLS certificate verification while connecting with the database. We strongly discourage to disable TLS verification during backup. You should provide the respective CA bundle through `spec.clientConfig.caBundle` field instead. + +- **spec.clientConfig.caBundle** + + `spec.clientConfig.caBundle` is a PEM encoded CA bundle which will be used to validate the serving certificate of the database. + +## Next Steps + +- Learn how to use KubeDB to manage various databases [here](/docs/guides/README.md). +- Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md). diff --git a/docs/guides/ferretdb/concepts/autoscaler.md b/docs/guides/ferretdb/concepts/autoscaler.md new file mode 100644 index 0000000000..589612ef35 --- /dev/null +++ b/docs/guides/ferretdb/concepts/autoscaler.md @@ -0,0 +1,73 @@ +--- +title: FerretDBAutoscaler CRD +menu: + docs_{{ .version }}: + identifier: fr-autoscaler-concepts + name: FerretDBAutoscaler + parent: fr-concepts-ferretdb + weight: 26 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# FerretDBAutoscaler + +## What is FerretDBAutoscaler + +`FerretDBAutoscaler` is a Kubernetes `Custom Resource Definitions` (CRD). It provides a declarative configuration for autoscaling `FerretDB` compute resources of FerretDB components in a Kubernetes native way. + +## FerretDBAutoscaler CRD Specifications + +Like any official Kubernetes resource, a `FerretDBAutoscaler` has `TypeMeta`, `ObjectMeta`, `Spec` and `Status` sections. + +Here, some sample `FerretDBAutoscaler` CROs for autoscaling different components of ferretdb is given below: + +**Sample `FerretDBAutoscaler` for ferretdb:** + +```yaml +apiVersion: autoscaling.kubedb.com/v1alpha1 +kind: FerretDBAutoscaler +metadata: + name: ferretdb-auto-scale + namespace: demo +spec: + databaseRef: + name: ferretdb + compute: + ferretdb: + trigger: "On" + podLifeTimeThreshold: 24h + minAllowed: + cpu: 250m + memory: 350Mi + maxAllowed: + cpu: 1 + memory: 1Gi + controlledResources: ["cpu", "memory"] + containerControlledValues: "RequestsAndLimits" + resourceDiffPercentage: 10 +``` + +Here, we are going to describe the various sections of a `FerretDBAutoscaler` crd. + +A `FerretDBAutoscaler` object has the following fields in the `spec` section. + +### spec.databaseRef + +`spec.databaseRef` is a required field that point to the [FerretDB](/docs/guides/ferretdb/concepts/ferretdb.md) object for which the autoscaling will be performed. This field consists of the following sub-field: + +- **spec.databaseRef.name :** specifies the name of the [FerretDB](/docs/guides/ferretdb/concepts/ferretdb.md) object. + +### spec.compute + +`spec.compute` specifies the autoscaling configuration for the compute resources i.e. cpu and memory of FerretDB components. This field consists of the following sub-field: + +- `trigger` indicates if compute autoscaling is enabled for this component of the ferretdb. If "On" then compute autoscaling is enabled. If "Off" then compute autoscaling is disabled. +- `minAllowed` specifies the minimal amount of resources that will be recommended, default is no minimum. +- `maxAllowed` specifies the maximum amount of resources that will be recommended, default is no maximum. +- `controlledResources` specifies which type of compute resources (cpu and memory) are allowed for autoscaling. Allowed values are "cpu" and "memory". +- `containerControlledValues` specifies which resource values should be controlled. Allowed values are "RequestsAndLimits" and "RequestsOnly". +- `resourceDiffPercentage` specifies the minimum resource difference between recommended value and the current value in percentage. If the difference percentage is greater than this value than autoscaling will be triggered. +- `podLifeTimeThreshold` specifies the minimum pod lifetime of at least one of the pods before triggering autoscaling. \ No newline at end of file diff --git a/docs/guides/ferretdb/concepts/catalog.md b/docs/guides/ferretdb/concepts/catalog.md new file mode 100644 index 0000000000..af2be706af --- /dev/null +++ b/docs/guides/ferretdb/concepts/catalog.md @@ -0,0 +1,74 @@ +--- +title: FerretDBVersion CRD +menu: + docs_{{ .version }}: + identifier: fr-catalog-concepts + name: FerretDBVersion + parent: fr-concepts-ferretdb + weight: 15 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# FerretDBVersion + +## What is FerretDBVersion + +`FerretDBVersion` is a Kubernetes `Custom Resource Definitions` (CRD). It provides a declarative configuration to specify the docker images to be used for [FerretDB](https://ferretdb.net/) server deployed with KubeDB in a Kubernetes native way. + +When you install KubeDB, a `FerretDBVersion` custom resource will be created automatically for every supported FerretDB release versions. You have to specify the name of `FerretDBVersion` crd in `spec.version` field of [FerretDB](/docs/guides/ferretdb/concepts/ferretdb.md) crd. Then, KubeDB will use the docker images specified in the `FerretDBVersion` crd to create your expected FerretDB instance. + +Using a separate crd for specifying respective docker image names allow us to modify the images independent of KubeDB operator. This will also allow the users to use a custom FerretDB image for their server. + +## FerretDBVersion Specification + +As with all other Kubernetes objects, a FerretDBVersion needs `apiVersion`, `kind`, and `metadata` fields. It also needs a `.spec` section. + +```yaml +apiVersion: catalog.kubedb.com/v1alpha1 +kind: FerretDBVersion +metadata: + name: 1.23.0 +spec: + db: + image: ghcr.io/appscode-images/ferretdb:1.23.0 + securityContext: + runAsUser: 1000 + version: 1.23.0 + deprecated: false +``` + +### metadata.name + +`metadata.name` is a required field that specifies the name of the `FerretDBVersion` crd. You have to specify this name in `spec.version` field of [FerretDB](/docs/guides/ferretdb/concepts/ferretdb.md) crd. + +We follow this convention for naming FerretDBVersion crd: + +- Name format: `{Original ferretdb image version}-{modification tag}` + +We plan to modify original FerretDB docker images to support additional features. Re-tagging the image with v1, v2 etc. modification tag help separating newer iterations from the older ones. An image with higher modification tag will have more features than the images with lower modification tag. Hence, it is recommended to use FerretDBVersion crd with higher modification tag to take advantage of the latest features. + +### spec.version + +`spec.version` is a required field that specifies the original version of FerretDB that has been used to build the docker image specified in `spec.server.image` field. + +### spec.deprecated + +`spec.deprecated` is an optional field that specifies whether the docker images specified here is supported by the current KubeDB operator. + +The default value of this field is `false`. If `spec.deprecated` is set `true`, KubeDB operator will not create the server and other respective resources for this version. + +### spec.ferretdb.image + +`spec.ferretdb.image` is a required field that specifies the docker image which will be used to create PetSet by KubeDB operator to create expected FerretDB server. + +### spec.securityContext + +`spec.securityContext` holds pod-level security attributes and common container settings for FerretDB pod. + +## Next Steps + +- Learn about FerretDB crd [here](/docs/guides/ferretdb/concepts/catalog.md). +- Deploy your first FerretDB server with KubeDB by following the guide [here](/docs/guides/ferretdb/quickstart/quickstart.md). \ No newline at end of file diff --git a/docs/guides/ferretdb/concepts/ferretdb.md b/docs/guides/ferretdb/concepts/ferretdb.md new file mode 100644 index 0000000000..bb1ca86ddb --- /dev/null +++ b/docs/guides/ferretdb/concepts/ferretdb.md @@ -0,0 +1,298 @@ +--- +title: FerretDB CRD +menu: + docs_{{ .version }}: + identifier: fr-ferretdb-concepts + name: FerretDB + parent: fr-concepts-ferretdb + weight: 10 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# FerretDB + +## What is FerretDB + +`FerretDB` is a Kubernetes `Custom Resource Definitions` (CRD). It provides declarative configuration for [FerretDB](https://www.ferretdb.com/) in a Kubernetes native way. You only need to describe the desired configuration in a `FerretDB`object, and the KubeDB operator will create Kubernetes objects in the desired state for you. + +## FerretDB Spec + +As with all other Kubernetes objects, a FerretDB needs `apiVersion`, `kind`, and `metadata` fields. It also needs a `.spec` section. Below is an example FerretDB object. + +```yaml +apiVersion: kubedb.com/v1alpha2 +kind: FerretDB +metadata: + name: ferretdb + namespace: demo +spec: + version: "1.23.0" + replicas: 1 + healthChecker: + failureThreshold: 3 + periodSeconds: 20 + timeoutSeconds: 10 + authSecret: + name: ferretdb-auth + externallyManaged: false + backend: + postgresRef: + name: ha-postgres + namespace: demo + version: "13.13" + linkedDB: "ferretdb" + externallyManaged: false + sslMode: requireSSL + tls: + issuerRef: + apiGroup: cert-manager.io + name: ferretdb-ca-issuer + kind: Issuer + certificates: + - alias: server + subject: + organizations: + - kubedb:server + dnsNames: + - localhost + ipAddresses: + - "127.0.0.1" + monitor: + agent: prometheus.io/operator + prometheus: + serviceMonitor: + labels: + release: prometheus + interval: 10s + deletionPolicy: WipeOut + podTemplate: + spec: + containers: + - name: ferretdb + resources: + limits: + memory: 1Gi + requests: + cpu: 200m + memory: 256Mi + serviceTemplates: + - alias: primary + spec: + type: ClusterIP + ports: + - name: http + port: 9999 +``` + +### spec.version + +`spec.version` is a required field specifying the name of the [FerretDBVersion](/docs/guides/ferretdb/concepts/catalog.md) crd where the docker images are specified. Currently, when you install KubeDB, it creates the following `FerretDBVersion` resources, + +- `1.18.0`, `1.23.0` + +### spec.replicas + +`spec.replicas` the number of members in ferretdb replicaset. + +KubeDB uses `PodDisruptionBudget` to ensure that majority of these replicas are available during [voluntary disruptions](https://kubernetes.io/docs/concepts/workloads/pods/disruptions/#voluntary-and-involuntary-disruptions) so that quorum is maintained. + +### spec.healthChecker +It defines the attributes for the health checker. +- `spec.healthChecker.periodSeconds` specifies how often to perform the health check. +- `spec.healthChecker.timeoutSeconds` specifies the number of seconds after which the probe times out. +- `spec.healthChecker.failureThreshold` specifies minimum consecutive failures for the healthChecker to be considered failed. +- `spec.healthChecker.disableWriteCheck` specifies whether to disable the writeCheck or not. + +### spec.authSecret + +`spec.authSecret` is an optional field that points to a Secret used to hold credentials for `ferretdb`. If not set, KubeDB operator creates a new Secret `{ferretdb-object-name}-auth` for storing the password for `ferretdb` user for each FerretDB object. +As FerretDB use backend's authentication mechanisms till now, this secret is basically a copy of backend postgres. + +We can use this field in 3 mode. +1. Using an external secret. In this case, You need to create an auth secret first with required fields, then specify the secret name when creating the FerretDB object using `spec.authSecret.name` & set `spec.authSecret.externallyManaged` to true. +```yaml +authSecret: + name: + externallyManaged: true +``` + +2. Specifying the secret name only. In this case, You need to specify the secret name when creating the FerretDB object using `spec.authSecret.name`. `externallyManaged` is by default false. +```yaml +authSecret: + name: +``` + +3. Let KubeDB do everything for you. In this case, no work for you. + +AuthSecret contains a `user` key and a `password` key which contains the `username` and `password` respectively for `ferretdb` user. + +Example: + +```bash +$ kubectl create secret generic ferretdb-auth -n demo \ +--from-literal=username=jhon \ +--from-literal=password=O9xE1mZZDAdBTbrV +secret "ferretdb-auth" created +``` + +```yaml +apiVersion: v1 +data: + password: "O9xE1mZZDAdBTbrV" + username: "jhon" +kind: Secret +metadata: + name: ferretdb-auth + namespace: demo +type: Opaque +``` + +Secrets provided by users are not managed by KubeDB, and therefore, won't be modified or garbage collected by the KubeDB operator (version 0.13.0 and higher). + +### spec.backend + +- `spec.backend.externallyManaged` represents how the backend will be managed. If its false, KubeDB will automatically create a KubeDB managed postgres. Otherwise you need refer a [AppBinding](/docs/guides/ferretdb/concepts/appbinding.md) name and namespace which represents information for external Postgres. +- `spec.backend.postgresRef` is a required field that points to the `appbinding` associated with the backend postgres. If the postgres is KubeDB managed an [AppBinding](/docs/guides/ferretdb/concepts/appbinding.md) will be created automatically upon creating the postgres. If the postgres is not KubeDB managed then you need to create an appbinding yourself. `spec.backend.postgresRef` takes the name (`spec.backend.postgresRef.Name`) of the appbinding and the namespace (`spec.backend.postgresRef.Namespace`) where the appbinding is created. +- `spec.backend.version` represents the version of backend postgres +- `spec.backend.linkedDB` represents in which database of backend postgres will be used by FerretDB to store data + +### spec.sslMode + +Enables TLS/SSL or mixed TLS/SSL used for all network connections. The value of [`sslMode`](https://docs.ferretdb.io/security/tls-connections/) field can be one of the following: + +| Value | Description | +| :----------: | :----------------------------------------------------------------------------------------------------------------------------- | +| `disabled` | The server does not use TLS/SSL. | +| `requireSSL` | The server uses and accepts only TLS/SSL encrypted connections. | + +### spec.tls + +`spec.tls` specifies the TLS/SSL configurations for the FerretDB. KubeDB uses [cert-manager](https://cert-manager.io/) v1 api to provision and manage TLS certificates. + +The following fields are configurable in the `spec.tls` section: + +- `issuerRef` is a reference to the `Issuer` or `ClusterIssuer` CR of [cert-manager](https://cert-manager.io/docs/concepts/issuer/) that will be used by `KubeDB` to generate necessary certificates. + + - `apiGroup` is the group name of the resource that is being referenced. Currently, the only supported value is `cert-manager.io`. + - `kind` is the type of resource that is being referenced. KubeDB supports both `Issuer` and `ClusterIssuer` as values for this field. + - `name` is the name of the resource (`Issuer` or `ClusterIssuer`) being referenced. + +- `certificates` (optional) are a list of certificates used to configure the server and/or client certificate. It has the following fields: + - `alias` represents the identifier of the certificate. It has the following possible value: + - `server` is used for server certificate identification. + - `client` is used for client certificate identification. + - `metrics-exporter` is used for metrics exporter certificate identification. + - `secretName` (optional) specifies the k8s secret name that holds the certificates. + > This field is optional. If the user does not specify this field, the default secret name will be created in the following format: `--cert`. + + - `subject` (optional) specifies an `X.509` distinguished name. It has the following possible field, + - `organizations` (optional) are the list of different organization names to be used on the Certificate. + - `organizationalUnits` (optional) are the list of different organization unit name to be used on the Certificate. + - `countries` (optional) are the list of country names to be used on the Certificate. + - `localities` (optional) are the list of locality names to be used on the Certificate. + - `provinces` (optional) are the list of province names to be used on the Certificate. + - `streetAddresses` (optional) are the list of a street address to be used on the Certificate. + - `postalCodes` (optional) are the list of postal code to be used on the Certificate. + - `serialNumber` (optional) is a serial number to be used on the Certificate. + You can find more details from [Here](https://golang.org/pkg/crypto/x509/pkix/#Name) + - `duration` (optional) is the period during which the certificate is valid. + - `renewBefore` (optional) is a specifiable time before expiration duration. + - `dnsNames` (optional) is a list of subject alt names to be used in the Certificate. + - `ipAddresses` (optional) is a list of IP addresses to be used in the Certificate. + - `uris` (optional) is a list of URI Subject Alternative Names to be set in the Certificate. + - `emailAddresses` (optional) is a list of email Subject Alternative Names to be set in the Certificate. + - `privateKey` (optional) specifies options to control private keys used for the Certificate. + - `encoding` (optional) is the private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8, respectively. It defaults to PKCS#1 if not specified. + +### spec.monitor + +FerretDB managed by KubeDB can be monitored with builtin-Prometheus and Prometheus operator out-of-the-box. To learn more, + +- [Monitor FerretDB with builtin Prometheus](/docs/guides/ferretdb/monitoring/using-builtin-prometheus.md) +- [Monitor FerretDB with Prometheus operator](/docs/guides/ferretdb/monitoring/using-prometheus-operator.md) + +### spec.deletionPolicy + +`deletionPolicy` gives flexibility whether to `nullify`(reject) the delete operation of `Pgpool` CR or which resources KubeDB should keep or delete when you delete `Pgpool` CR. KubeDB provides following four deletion policies: + +- DoNotTerminate +- Delete +- WipeOut (`Default`) + +When `deletionPolicy` is `DoNotTerminate`, KubeDB takes advantage of `ValidationWebhook` feature in Kubernetes 1.9.0 or later clusters to implement `DoNotTerminate` feature. If admission webhook is enabled, `DoNotTerminate` prevents users from deleting the database as long as the `spec.deletionPolicy` is set to `DoNotTerminate`. + +Following table show what KubeDB does when you delete Pgpool CR for different deletion policies, + +| Behavior | DoNotTerminate | Delete | WipeOut | +|---------------------------| :------------: |:------------:| :------: | +| 1. Block Delete operation | ✓ | ✗ | ✗ | +| 2. Delete PetSet | ✗ | ✓ | ✓ | +| 3. Delete Services | ✗ | ✓ | ✓ | +| 4. Delete Secrets | ✗ | ✗ | ✓ | + +If you don't specify `spec.deletionPolicy` KubeDB uses `Delete` deletion policy by default. + +### spec.podTemplate + +KubeDB allows providing a template for pod through `spec.podTemplate`. KubeDB operator will pass the information provided in `spec.podTemplate` to the PetSet created for Pgpool. + +KubeDB accept following fields to set in `spec.podTemplate:` + +- metadata: + - annotations (pod's annotation) + - labels (pod's labels) +- controller: + - annotations (statefulset's annotation) + - labels (statefulset's labels) +- spec: + - volumes + - initContainers + - containers + - imagePullSecrets + - nodeSelector + - affinity + - serviceAccountName + - schedulerName + - tolerations + - priorityClassName + - priority + - securityContext + - livenessProbe + - readinessProbe + - lifecycle + +You can check out the full list [here](https://github.com/kmodules/offshoot-api/blob/39bf8b2/api/v2/types.go#L44-L279). Uses of some field of `spec.podTemplate` is described below, + +#### spec.podTemplate.spec.nodeSelector + +`spec.podTemplate.spec.nodeSelector` is an optional field that specifies a map of key-value pairs. For the pod to be eligible to run on a node, the node must have each of the indicated key-value pairs as labels (it can have additional labels as well). To learn more, see [here](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) . + +#### spec.podTemplate.spec.resources + +`spec.podTemplate.spec.resources` is an optional field. This can be used to request compute resources required by the database pods. To learn more, visit [here](http://kubernetes.io/docs/user-guide/compute-resources/). + +### spec.serviceTemplates + +You can also provide template for the services created by KubeDB operator for Kafka cluster through `spec.serviceTemplates`. This will allow you to set the type and other properties of the services. + +KubeDB allows following fields to set in `spec.serviceTemplates`: +- `alias` represents the identifier of the service. It has the following possible value: + - `stats` is used for the exporter service identification. +- metadata: + - labels + - annotations +- spec: + - type + - ports + - clusterIP + - externalIPs + - loadBalancerIP + - loadBalancerSourceRanges + - externalTrafficPolicy + - healthCheckNodePort + - sessionAffinityConfig + +See [here](https://github.com/kmodules/offshoot-api/blob/kubernetes-1.21.1/api/v1/types.go#L237) to understand these fields in detail. \ No newline at end of file diff --git a/docs/guides/ferretdb/concepts/opsrequest.md b/docs/guides/ferretdb/concepts/opsrequest.md new file mode 100644 index 0000000000..6deb7e1ce9 --- /dev/null +++ b/docs/guides/ferretdb/concepts/opsrequest.md @@ -0,0 +1,258 @@ +--- +title: FerretDBOpsRequests CRD +menu: + docs_{{ .version }}: + identifier: fr-opsrequest-concepts + name: FerretDBOpsRequest + parent: fr-concepts-ferretdb + weight: 25 +menu_name: docs_{{ .version }} +section_menu_id: guides +--- + +> New to KubeDB? Please start [here](/docs/README.md). + +# FerretDBOpsRequest + +## What is FerretDBOpsRequest + +`FerretDBOpsRequest` is a Kubernetes `Custom Resource Definitions` (CRD). It provides a declarative configuration for `FerretDB` administrative operations like version updating, horizontal scaling, vertical scaling etc. in a Kubernetes native way. + +## FerretDBOpsRequest CRD Specifications + +Like any official Kubernetes resource, a `FerretDBOpsRequest` has `TypeMeta`, `ObjectMeta`, `Spec` and `Status` sections. + +Here, some sample `FerretDBOpsRequest` CRs for different administrative operations is given below: + +**Sample `FerretDBOpsRequest` for updating version:** + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: FerretDBOpsRequest +metadata: + name: ferretdb-version-update + namespace: demo +spec: + type: UpdateVersion + databaseRef: + name: ferretdb + updateVersion: + targetVersion: 1.23.0 +``` + +**Sample `FerretDBOpsRequest` Objects for Horizontal Scaling:** + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: FerretDBOpsRequest +metadata: + name: ferretdb-horizontal-scale + namespace: demo +spec: + type: HorizontalScaling + databaseRef: + name: ferretdb + horizontalScaling: + node: 3 +``` + +**Sample `FerretDBOpsRequest` Objects for Vertical Scaling:** + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: FerretDBOpsRequest +metadata: + name: ferretdb-vertical-scale + namespace: demo +spec: + type: VerticalScaling + databaseRef: + name: ferretdb + verticalScaling: + node: + resources: + requests: + memory: "1200Mi" + cpu: "0.7" + limits: + memory: "1200Mi" + cpu: "0.7" +``` + +**Sample `FerretDBOpsRequest` Objects for Reconfiguring TLS:** + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: FerretDBOpsRequest +metadata: + name: tls + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: ferretdb + tls: + sslMode: requireSSL + issuerRef: + name: ferretdb-ca-issuer + kind: Issuer + apiGroup: "cert-manager.io" + certificates: + - alias: client + subject: + organizations: + - kubedb + organizationalUnits: + - client +``` + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: FerretDBOpsRequest +metadata: + name: tls + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: ferretdb + tls: + rotateCertificates: true +``` + +```yaml +apiVersion: ops.kubedb.com/v1alpha1 +kind: FerretDBOpsRequest +metadata: + name: tls + namespace: demo +spec: + type: ReconfigureTLS + databaseRef: + name: ferretdb + tls: + remove: true +``` + +Here, we are going to describe the various sections of a `FerretDBOpsRequest` crd. + +A `FerretDBOpsRequest` object has the following fields in the `spec` section. + +### spec.databaseRef + +`spec.databaseRef` is a required field that point to the [FerretDB](/docs/guides/ferretdb/concepts/ferretdb.md) object for which the administrative operations will be performed. This field consists of the following sub-field: + +- **spec.databaseRef.name :** specifies the name of the [FerretDB](/docs/guides/ferretdb/concepts/ferretdb.md) object. + +### spec.type + +`spec.type` specifies the kind of operation that will be applied to the database. Currently, the following types of operations are allowed in `FerretDBOpsRequest`. + +- `Upgrade` / `UpdateVersion` +- `HorizontalScaling` +- `VerticalScaling` +- `ReconfigureTLS` +- `Restart` + +> You can perform only one type of operation on a single `FerretDBOpsRequest` CR. For example, if you want to update your database and scale up its replica then you have to create two separate `FerretDBOpsRequest`. At first, you have to create a `FerretDBOpsRequest` for updating. Once it is completed, then you can create another `FerretDBOpsRequest` for scaling. + +### spec.updateVersion + +If you want to update your FerretDB version, you have to specify the `spec.updateVersion` section that specifies the desired version information. This field consists of the following sub-field: + +- `spec.updateVersion.targetVersion` refers to a [FerretDBVersion](/docs/guides/ferretdb/concepts/catalog.md) CR that contains the FerretDB version information where you want to update. + + +### spec.horizontalScaling + +If you want to scale-up or scale-down your FerretDB cluster or different components of it, you have to specify `spec.horizontalScaling` section. This field consists of the following sub-field: + +- `spec.horizontalScaling.node` indicates the desired number of pods for FerretDB cluster after scaling. For example, if your cluster currently has 4 pods, and you want to add additional 2 pods then you have to specify 6 in `spec.horizontalScaling.node` field. Similarly, if you want to remove one pod from the cluster, you have to specify 3 in `spec.horizontalScaling.node` field. + +### spec.verticalScaling + +`spec.verticalScaling` is a required field specifying the information of `FerretDB` resources like `cpu`, `memory` etc. that will be scaled. This field consists of the following sub-fields: + +- `spec.verticalScaling.node` indicates the desired resources for PetSet of FerretDB after scaling. + +It has the below structure: + +```yaml +requests: + memory: "200Mi" + cpu: "0.1" +limits: + memory: "300Mi" + cpu: "0.2" +``` + +Here, when you specify the resource request, the scheduler uses this information to decide which node to place the container of the Pod on and when you specify a resource limit for the container, the `kubelet` enforces those limits so that the running container is not allowed to use more of that resource than the limit you set. You can found more details from [here](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). + +### spec.tls + +If you want to reconfigure the TLS configuration of your ferretdb cluster i.e. add TLS, remove TLS, update issuer/cluster issuer or Certificates and rotate the certificates, you have to specify `spec.tls` section. This field consists of the following sub-field: + +- `spec.tls.issuerRef` specifies the issuer name, kind and api group. +- `spec.tls.certificates` specifies the certificates. You can learn more about this field from [here](/docs/guides/ferretdb/concepts/ferretdb.md#spectls). +- `spec.tls.rotateCertificates` specifies that we want to rotate the certificate of this database. +- `spec.tls.remove` specifies that we want to remove tls from this database. +- `spec.tls.sslMode` specifies what will be the ssl mode of the cluster allowed values are: disable,allow,prefer,require,verify-ca,verify-full +- `spec.tls.clientAuthMode` specifies what will be the client authentication mode of the cluster allowed values are: md5,scram,cert + +### spec.timeout +As we internally retry the ops request steps multiple times, This `timeout` field helps the users to specify the timeout for those steps of the ops request (in second). +If a step doesn't finish within the specified timeout, the ops request will result in failure. + +### spec.apply +This field controls the execution of obsRequest depending on the database state. It has two supported values: `Always` & `IfReady`. +Use IfReady, if you want to process the opsRequest only when the database is Ready. And use Always, if you want to process the execution of opsReq irrespective of the Database state. + + +### FerretDBOpsRequest `Status` + +`.status` describes the current state and progress of a `FerretDBOpsRequest` operation. It has the following fields: + +### status.phase + +`status.phase` indicates the overall phase of the operation for this `FerretDBOpsRequest`. It can have the following three values: + +| Phase | Meaning | +|-------------|------------------------------------------------------------------------------------| +| Successful | KubeDB has successfully performed the operation requested in the FerretDBOpsRequest | +| Progressing | KubeDB has started the execution of the applied FerretDBOpsRequest | +| Failed | KubeDB has failed the operation requested in the FerretDBOpsRequest | +| Denied | KubeDB has denied the operation requested in the FerretDBOpsRequest | +| Skipped | KubeDB has skipped the operation requested in the FerretDBOpsRequest | + +Important: Ops-manager Operator can skip an opsRequest, only if its execution has not been started yet & there is a newer opsRequest applied in the cluster. `spec.type` has to be same as the skipped one, in this case. + +### status.observedGeneration + +`status.observedGeneration` shows the most recent generation observed by the `FerretDBOpsRequest` controller. + +### status.conditions + +`status.conditions` is an array that specifies the conditions of different steps of `FerretDBOpsRequest` processing. Each condition entry has the following fields: + +- `types` specifies the type of the condition. FerretDBOpsRequest has the following types of conditions: + +| Type | Meaning | +|--------------------------------|---------------------------------------------------------------------------| +| `Progressing` | Specifies that the operation is now in the progressing state | +| `Successful` | Specifies such a state that the operation on the database was successful. | +| `DatabasePauseSucceeded` | Specifies such a state that the database is paused by the operator | +| `ResumeDatabase` | Specifies such a state that the database is resumed by the operator | +| `Failed` | Specifies such a state that the operation on the database failed. | +| `UpdatePetSetResources` | Specifies such a state that the PetSet resources has been updated | +| `UpdatePetSet` | Specifies such a state that the PetSet has been updated | +| `IssueCertificatesSucceeded` | Specifies such a state that the tls certificate issuing is successful | +| `UpdateDatabase` | Specifies such a state that the CR of FerretDB is updated | + +- The `status` field is a string, with possible values `True`, `False`, and `Unknown`. + - `status` will be `True` if the current transition succeeded. + - `status` will be `False` if the current transition failed. + - `status` will be `Unknown` if the current transition was denied. +- The `message` field is a human-readable message indicating details about the condition. +- The `reason` field is a unique, one-word, CamelCase reason for the condition's last transition. +- The `lastTransitionTime` field provides a timestamp for when the operation last transitioned from one state to another. +- The `observedGeneration` shows the most recent condition transition generation observed by the controller. diff --git a/docs/guides/mongodb/concepts/mongodb.md b/docs/guides/mongodb/concepts/mongodb.md index 2818fad57e..4931376ad2 100644 --- a/docs/guides/mongodb/concepts/mongodb.md +++ b/docs/guides/mongodb/concepts/mongodb.md @@ -366,7 +366,7 @@ The following fields are configurable in the `spec.tls` section: - `uris` (optional) is a list of URI Subject Alternative Names to be set in the Certificate. - `emailAddresses` (optional) is a list of email Subject Alternative Names to be set in the Certificate. - `privateKey` (optional) specifies options to control private keys used for the Certificate. - - `encoding` (optional) is the private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8, respectively. It defaults to PKCS#1 if not specified. + - `encoding` (optional) is the private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8, respectively. It defaults to PKCS#1 if not specified. ### spec.clusterAuthMode diff --git a/docs/guides/pgpool/concepts/pgpool.md b/docs/guides/pgpool/concepts/pgpool.md index 9b43fe7bc2..2674f24d44 100644 --- a/docs/guides/pgpool/concepts/pgpool.md +++ b/docs/guides/pgpool/concepts/pgpool.md @@ -236,7 +236,7 @@ The following fields are configurable in the `spec.tls` section: - `uris` (optional) is a list of URI Subject Alternative Names to be set in the Certificate. - `emailAddresses` (optional) is a list of email Subject Alternative Names to be set in the Certificate. - `privateKey` (optional) specifies options to control private keys used for the Certificate. - - `encoding` (optional) is the private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8, respectively. It defaults to PKCS#1 if not specified. + - `encoding` (optional) is the private key cryptography standards (PKCS) encoding for this certificate's private key to be encoded in. If provided, allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8, respectively. It defaults to PKCS#1 if not specified. ### spec.monitor